Is Street View Maps safe?
Street View Maps renders remote HTML from its own server into the new tab page without sanitization and transmits every search keystroke to its server.
On each new tab load, the extension fetches HTML from streetviewmaps.net and injects it directly via dangerouslySetInnerHTML in a privileged chrome-extension:// context, with no sanitization. Every character typed into the search box is sent to the operator's autosuggest endpoint before the user submits a query. On first use or when local storage is cleared, completed searches are also routed through the operator's own search endpoint rather than the user's default search engine.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
New tab search box sends each keystroke to streetviewmaps.net
Typing in Street View Maps' new-tab search box sends the text so far to streetviewmaps.net on every keystroke, for autocomplete.
Confirmed: typed strings appeared verbatim in q= on requests to .../public/autosuggest, with no debounce.
You type a search term into the box on a new tab page.
Each character you add updates the input value the extension tracks.
The extension sends what you have typed so far to streetviewmaps.net to fetch suggestions.
Both the small top-bar search and the main search box make their own request on every change to the text.
| Field | Value | Why it matters | |
|---|---|---|---|
Your search text | q=canaryquery | Whatever you've typed into the new-tab search box so far, sent each keystroke. Search terms can reveal interests, intentions, and locations. |
The keystroke-bound effects that issue the request
useEffect(() => {
fetchTopbarSuggestions("topbar");
}, [a]); // a = current text in the top-bar search input
function fetchTopbarSuggestions() {
if (a.length === 0) { ee([]); return; }
// jQuery $.getJSON — one request per change to `a`, no debounce
$.getJSON(
"https://streetviewmaps.net/extension/public/autosuggest?q=" + encodeURIComponent(a),
(resp) => {
if (!resp.toString().includes("Server Error:")) {
renderResults(resp.gossip.results);
}
}
);
}useEffect(() => {
if (a.length === 0) { setResults([]); return; }
// axios .get — one request per change to `a`, no debounce
axios
.get("https://streetviewmaps.net/extension/public/autosuggest?q=" + encodeURIComponent(a))
.then((resp) => {
const data = resp.data;
if (!data.toString().includes("Server Error:")) {
setResults(data.gossip.results);
}
})
.catch((e) => console.log(e));
}, [a]); // a = current text in the main search input